libelf: Correct shdr size check for (raw) getdata.

Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 5ad20a6af9405c78fb8406a0ff954f27e6001550..dd0a755640cee770318afa4c7d57d9d55793eed7 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,9 @@
+2014-11-07  Mark Wielaard  <mjw@redhat.com>
+
+       * elf_begin.c (file_read_elf): Correct sh_size check.
+       * elf_getdata.c (__libelf_set_rawdata_wrlock): Check for unsigned
+       overflow.
+
 2014-09-10  Petr Machata  <pmachata@redhat.com>
 
        * elf_begin (read_unmmaped_file): Call __libelf_seterrno if the

diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index c3ad1406c9d25391f18e5d4c98b98b390e4c5811..5525a3b5e354651f71336c29743de63cd970ab35 100644 (file)
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -337,8 +337,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident,
              elf->state.elf32.scns.data[cnt].shdr.e32 =
                &elf->state.elf32.shdr[cnt];
              if (likely (elf->state.elf32.shdr[cnt].sh_offset < maxsize)
-                 && likely (maxsize - elf->state.elf32.shdr[cnt].sh_offset
-                            <= elf->state.elf32.shdr[cnt].sh_size))
+                 && likely (elf->state.elf32.shdr[cnt].sh_size
+                            <= maxsize - elf->state.elf32.shdr[cnt].sh_offset))
                elf->state.elf32.scns.data[cnt].rawdata_base =
                  elf->state.elf32.scns.data[cnt].data_base =
                  ((char *) map_address + offset
@@ -428,8 +428,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident,
              elf->state.elf64.scns.data[cnt].shdr.e64 =
                &elf->state.elf64.shdr[cnt];
              if (likely (elf->state.elf64.shdr[cnt].sh_offset < maxsize)
-                 && likely (maxsize - elf->state.elf64.shdr[cnt].sh_offset
-                            <= elf->state.elf64.shdr[cnt].sh_size))
+                 && likely (elf->state.elf64.shdr[cnt].sh_size
+                            <= maxsize - elf->state.elf64.shdr[cnt].sh_offset))
                elf->state.elf64.scns.data[cnt].rawdata_base =
                  elf->state.elf64.scns.data[cnt].data_base =
                  ((char *) map_address + offset

diff --git a/libelf/elf_getdata.c b/libelf/elf_getdata.c
index bc9f26ae57341b9f1cf5151f3f525c2f0a8f5938..33d35d6f0520c10e41e4bb3ea83d2b4bcf2003f4 100644 (file)
--- a/libelf/elf_getdata.c
+++ b/libelf/elf_getdata.c
@@ -243,8 +243,11 @@ __libelf_set_rawdata_wrlock (Elf_Scn *scn)
       if (elf->map_address != NULL)
        {
          /* First see whether the information in the section header is
-            valid and it does not ask for too much.  */
-         if (unlikely (offset + size > elf->maximum_size))
+            valid and it does not ask for too much.  Check for unsigned
+            overflow.  */
+         if (unlikely (offset + size > elf->maximum_size
+                       || (offset + size + elf->maximum_size
+                           < elf->maximum_size)))
            {
              /* Something is wrong.  */
              __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);